Privacy Policy

Last updated: November 7, 2026

1. Introduction

PaperNext is a client application for paperless-ngx, provided by rebtsoft UG (haftungsbeschränkt) (see imprint). This privacy policy explains how data is handled when using the application.

PaperNext connects to your self-hosted paperless-ngx server. Your documents and their data remain on your own server and on your device. The only exception is the optional push service "PaperNext Push" (section 6), which processes a small amount of technical data on our servers.

2. Data Processed by the App

The application processes only the local data necessary for its operation:

Server URL and authentication data (stored locally and securely)
Document metadata and content retrieved from your paperless-ngx server and stored locally
Local application settings and preferences

Without the push service, no data is transmitted to us or to external services.

3. Purpose of Processing

This data is used exclusively to:

establish a connection to your paperless-ngx server
display and manage your documents
cache documents and previews locally for offline access
synchronize changes with your server
deliver notifications about new documents, if you use the push service

4. Data Storage on Your Device

Authentication data is stored in the platform-specific secure storage
Documents and metadata are stored in a local SQLite database
Preview images are cached in temporary storage

Any processing of personal data in your documents occurs solely on your self-hosted paperless-ngx server under the responsibility of its administrator.

5. Data Security

The following measures are implemented:

Access credentials are stored in secure, platform-specific storage
Communication with your server uses HTTPS (if configured)
Communication with the push service is always encrypted (HTTPS); access secrets are stored there only as hashes
No analytics or tracking services are used

6. Push Service "PaperNext Push" (optional)

If you subscribe to and enable PaperNext Push, the following data is processed on our servers (push.papernext.de):

the push token of your device, its platform (iOS or Android) and the app language, to deliver notifications
subscription data from the App Store or Google Play (purchase reference, product, status and term), to check that your subscription is active
a hash of your paperless-ngx username, so that notifications only reach the devices of the document owner
for each event from your server, the document ID and the username of the document owner; these are used to forward the notification and are not stored
technical identifiers and access secrets for your server's webhook and your device (secrets only as hashes), plus timestamps

Not processed: titles, content or files of your documents, and the address of your server. The app on your device loads a document's title directly from your own server.

When your device or server connects to the push service, its IP address is necessarily processed to establish the connection. The push service does not store IP addresses.

Hosting. The push service runs on servers of Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany, which processes data on our behalf as a data processor.

Recipients. Notifications are delivered via the Apple Push Notification service (Apple) or Firebase Cloud Messaging (Google). Subscriptions are purchased and billed through Apple or Google; to verify a subscription, we query their servers. Apple and Google may process data outside the EU; their own privacy policies apply.

Legal basis. Art. 6(1)(b) GDPR (performance of the contract for the push service).

Retention. Device data is deleted when you turn off push notifications in the app, or when Apple or Google report the push token as no longer valid. Subscription data is kept as long as it is needed to verify the subscription and to meet legal obligations.

7. Third-Party Services

PaperNext does not use any analytics, tracking, or advertising services. The app communicates with your configured paperless-ngx server and, only if you use the push service, with push.papernext.de and the delivery services of Apple or Google (section 6).

8. Data Deletion

You can delete locally stored data at any time:

"Delete local data" removes documents and metadata
"Clear preview cache" removes cached preview images
Uninstalling the app removes all locally stored data
Turning off push notifications in the app deletes your device's data from the push service

9. Your Rights

Under the GDPR, you have the right to access, rectification, erasure, restriction of processing, data portability and to object to processing. You also have the right to lodge a complaint with a data protection supervisory authority. To exercise your rights, contact us at the address below.

10. Children's Privacy

PaperNext is not intended for children under the age of 13. We do not knowingly collect data from children.

11. Changes to This Policy

This privacy policy may be updated from time to time. Changes will be indicated by updating the "Last updated" date.

Website papernext.de

When you visit this website, the web server processes technically necessary access data (IP address, date and time, requested page, browser and operating system, referring page) in server log files. This serves the secure and stable operation of the website (Art. 6(1)(f) GDPR). The log files are deleted automatically after a short period. The website is hosted by Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany.

The website sets no cookies, uses no analytics or tracking services and loads no content from third parties. Fonts and videos are served directly from this server. Links to the App Store, Google Play and the forum lead to third-party services, whose own privacy policies apply.

12. Contact

If you have questions regarding this privacy policy:

rebtsoft UG (haftungsbeschränkt), see imprint
Email: kontakt@rebtsoft.com

For questions about data processing on your server, please contact the administrator of your self-hosted paperless-ngx instance.